feat(security): LDAP auth timeout/concurrency/outage-circuit options; project ConnectionTimeoutMs into the shared library (03/S2)

2026-07-13 11:38:37 -04:00
parent ce6d9e21d3
commit 09faa05f06
5 changed files with 197 additions and 1 deletions
@@ -47,5 +47,18 @@ public sealed class LdapOptionsValidator : OptionsValidatorBase<LdapOptions>
        builder.RequireThat(
            !(options.Transport == LdapTransport.None && !options.AllowInsecure),
            "LDAP transport is None (plaintext) but AllowInsecure is false — set Transport to Ldaps/StartTls or set AllowInsecure for dev.");
+
+        // S2 resilience knobs — a non-positive timeout / concurrency bound would silently disable the
+        // wall-clock/concurrency protection the OPC UA data-plane authenticator relies on, so fail fast.
+        builder.RequireThat(options.ConnectionTimeoutMs > 0,
+            "Ldap:ConnectionTimeoutMs must be > 0.");
+        builder.RequireThat(options.AuthTimeoutMs > 0,
+            "Ldap:AuthTimeoutMs must be > 0.");
+        builder.RequireThat(options.MaxConcurrentAuthentications > 0,
+            "Ldap:MaxConcurrentAuthentications must be > 0.");
+        // An open circuit with no cooldown would re-probe LDAP on every call — pointless. Only enforce
+        // a positive cooldown when the circuit is actually enabled (OutageFailureThreshold > 0; 0 disables).
+        builder.RequireThat(options.OutageFailureThreshold <= 0 || options.OutageCooldownSeconds > 0,
+            "Ldap:OutageCooldownSeconds must be > 0 when Ldap:OutageFailureThreshold > 0 (0 disables the circuit).");
    }
 }